mlsanityData to 14 Oct 2026

Auditing Anonymous AI Models: A Four-Stage Protocol for Black-Box Identity Verification

arXiv 2608.31142 ↗First posted 31 Aug 2026cs.SE cs.AI cs.CRcited by 0

Not on the map. Why?

Abstract (arXiv)

The 2025--2026 AI market has seen a wave of stealth releases: frontier models launched anonymously on developer platforms under codenames. For their users, identity determines data-handling terms, supply-chain risk, and capability expectations. No validated methodology exists for black-box identity verification of anonymous models: practitioner checklists lack accuracy evidence, and self-identification is untrustworthy by design. We propose a four-stage forensic audit protocol for API-served models. Stage 0 reconstructs launch-time configuration from archived platform snapshots (Internet Archive), exposing preview--production drift. Stage 1 fingerprints configuration (context, output ceiling, reasoning, modality) against the platform catalog. Stage 2 tests tokenizer identity with a cross-length differential that rejects short-prompt collisions. Stage 3 corroborates with behavioral probes. We test declaration consistency on 10 known-identity releases (7 exact, 2 precision-differences, 1 partial, 0 counter-directional), not end-to-end identification under anonymity. Identification is validated prospectively on a flagship case whose 2026-08-23 analysis pointed to the GLM-5.3 version line and whose official reveal confirmed those family and version-line inferences (deployment variant was not pre-asserted; Flash was consistent post-reveal), and on three Stage-0-only cases where the protocol produced a graded hypothesis or declined rather than guessed. A standard-library-only implementation is provided as supplementary material.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 18 of its 32 references that are in the map. First posted on arXiv 31 Aug 2026.

Builds on

18 of 32 references.

References · 18

  1. 2015Neural Machine Translation of Rare Words with Subword Unitscited by 2,918
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  3. 2018SentencePiece: A simple and language independent subword tokenizer and detokenizer for Neural Text Processingcited by 1,989
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  5. 2018Model Cards for Model Reportingcited by 1,080
  6. 2023DetectGPT: Zero-Shot Machine-Generated Text Detection using Probability Curvaturecited by 726
  7. 2023A Watermark for Large Language Modelscited by 725
  8. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  9. 2019GLTR: Statistical Detection and Visualization of Generated Textcited by 496
  10. 2023Fast-DetectGPT: Efficient Zero-Shot Detection of Machine-Generated Text via Conditional Probability Curvaturecited by 287
  11. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 214
  12. 2024Stealing Part of a Production Language Modelcited by 159
6 more
  1. 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 100
  2. 2020Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attackscited by 61
  3. 2022On the Robustness of Dataset Inferencecited by 8
  4. 2025Are Robust LLM Fingerprints Adversarially Robust?cited by 8
  5. 2026One Token Is Enough: Fingerprinting and Verifying Large Language Models from Single-Token Output Distributionscited by 6
  6. 2026Behavioral Fingerprints for LLM Endpoint Stability and Identitycited by 4

Built on by

Not cited yet.